# Vulnerabilities published in 2021


- [CVE-2021-31658](https://insights.sbomify.com/CVE-2021-31658/): Memory corruption in tp-link:tl-sg2005 firmware (high 8.1)
- [CVE-2021-31655](https://insights.sbomify.com/CVE-2021-31655/): Cross-site scripting in trendnet:tv-ip110wn firmware (medium 6.1)
- [CVE-2021-31651](https://insights.sbomify.com/CVE-2021-31651/): Cross-site scripting in neofr:neofrag (medium 4.8)
- [CVE-2021-31650](https://insights.sbomify.com/CVE-2021-31650/): SQL injection in online grading system project:online grading system (critical 9.8)
- [CVE-2021-3165](https://insights.sbomify.com/CVE-2021-3165/): Privilege escalation in missionlabs:smartagent (high 8.8)
- [CVE-2021-31649](https://insights.sbomify.com/CVE-2021-31649/): JFinal Java Deserialization Vulnerability (critical 9.8)
- [CVE-2021-31646](https://insights.sbomify.com/CVE-2021-31646/): Weak cryptography in gestsup:gestsup (critical 9.8)
- [CVE-2021-31645](https://insights.sbomify.com/CVE-2021-31645/): Denial of service in glftpd:glftpd (high 7.5)
- [CVE-2021-31643](https://insights.sbomify.com/CVE-2021-31643/): Cross-site scripting in chiyu-tech:bf-630 firmware (medium 5.4)
- [CVE-2021-31642](https://insights.sbomify.com/CVE-2021-31642/): Integer overflow in chiyu-tech:bf-630 firmware (medium 6.5)
- [CVE-2021-31641](https://insights.sbomify.com/CVE-2021-31641/): Cross-site scripting in chiyu-tech:bf-430 firmware (medium 6.1)
- [CVE-2021-3164](https://insights.sbomify.com/CVE-2021-3164/): File upload in churchdesk:churchrota (high 8.8)
- [CVE-2021-31637](https://insights.sbomify.com/CVE-2021-31637/): Code injection in uwamp project:uwamp (high 7.8)
- [CVE-2021-31635](https://insights.sbomify.com/CVE-2021-31635/): jFinal Server-Side Template Injection vulnerability (critical 9.8)
- [CVE-2021-31632](https://insights.sbomify.com/CVE-2021-31632/): SQL injection in b2evolution:b2evolution cms (critical 9.8)
- [CVE-2021-31631](https://insights.sbomify.com/CVE-2021-31631/): Cross-site request forgery in b2evolution:b2evolution cms (high 8.8)
- [CVE-2021-31630](https://insights.sbomify.com/CVE-2021-31630/): Command injection in openplcproject:openplc v3 firmware (high 8.8)
- [CVE-2021-3163](https://insights.sbomify.com/CVE-2021-3163/): Cross-site Scripting in quill (medium 6.1)
- [CVE-2021-31627](https://insights.sbomify.com/CVE-2021-31627/): Memory corruption in tendacn:ac9 firmware (high 8.8)
- [CVE-2021-31624](https://insights.sbomify.com/CVE-2021-31624/): Memory corruption in tendacn:ac9 firmware (high 8.8)
- [CVE-2021-3162](https://insights.sbomify.com/CVE-2021-3162/): Privilege escalation in docker:docker (high 7.8)
- [CVE-2021-31618](https://insights.sbomify.com/CVE-2021-31618/): NULL pointer dereference on specially crafted HTTP/2 request (high 7.5)
- [CVE-2021-31617](https://insights.sbomify.com/CVE-2021-31617/): Memory corruption in stormshield:stormshield network security (critical 9.8)
- [CVE-2021-31616](https://insights.sbomify.com/CVE-2021-31616/): Memory corruption in shapeshift:keepkey firmware (high 8.8)
- [CVE-2021-31615](https://insights.sbomify.com/CVE-2021-31615/): Race condition in bluetooth:bluetooth core specification (medium 5.3)
- [CVE-2021-31613](https://insights.sbomify.com/CVE-2021-31613/): Denial of service in zh-jieli:ac6901 firmware (medium 6.5)
- [CVE-2021-31612](https://insights.sbomify.com/CVE-2021-31612/): Denial of service in zh-jieli:ac6901 firmware (medium 6.5)
- [CVE-2021-31611](https://insights.sbomify.com/CVE-2021-31611/): Denial of service in zh-jieli:ac6901 firmware (medium 5.7)
- [CVE-2021-31610](https://insights.sbomify.com/CVE-2021-31610/): Denial of service in bluetrum:ab5376t firmware (medium 6.5)
- [CVE-2021-31609](https://insights.sbomify.com/CVE-2021-31609/): Denial of service in silabs:iwrap (medium 6.5)
- [CVE-2021-31608](https://insights.sbomify.com/CVE-2021-31608/): Security feature bypass in proofpoint:enterprise protection (medium 4.3)
- [CVE-2021-31607](https://insights.sbomify.com/CVE-2021-31607/): Command Injection in SaltStack Salt (high 7.8)
- [CVE-2021-31606](https://insights.sbomify.com/CVE-2021-31606/): furlongm openvpn-monitor allows Authorization Bypass to disconnect arbitrary clients (high 7.5)
- [CVE-2021-31605](https://insights.sbomify.com/CVE-2021-31605/): furlongm openvpn-monitor command injection (high 7.5)
- [CVE-2021-31604](https://insights.sbomify.com/CVE-2021-31604/): furlongm openvpn-monitor allows CSRF to disconnect an arbitrary client (medium 6.5)
- [CVE-2021-31602](https://insights.sbomify.com/CVE-2021-31602/): Auth bypass in hitachi:vantara pentaho (medium 5.3)
- [CVE-2021-31601](https://insights.sbomify.com/CVE-2021-31601/): Missing authorization in hitachi:vantara pentaho (high 7.1)
- [CVE-2021-31600](https://insights.sbomify.com/CVE-2021-31600/): Information disclosure in hitachi:vantara pentaho (medium 4.3)
- [CVE-2021-3160](https://insights.sbomify.com/CVE-2021-3160/): Deserialization in aca:assuweb (critical 9.8)
- [CVE-2021-31599](https://insights.sbomify.com/CVE-2021-31599/): Code injection in hitachi:vantara pentaho (high 8.8)
- [CVE-2021-31598](https://insights.sbomify.com/CVE-2021-31598/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2021-31597](https://insights.sbomify.com/CVE-2021-31597/): Improper Certificate Validation in xmlhttprequest-ssl (critical 9.4)
- [CVE-2021-31590](https://insights.sbomify.com/CVE-2021-31590/): Privilege escalation in pwndoc project:pwndoc (high 8.8)
- [CVE-2021-3159](https://insights.sbomify.com/CVE-2021-3159/): Cross-site scripting in landray:landray ekp (medium 5.4)
- [CVE-2021-31589](https://insights.sbomify.com/CVE-2021-31589/): Cross-site scripting in beyondtrust:appliance base software (medium 6.1)
- [CVE-2021-31586](https://insights.sbomify.com/CVE-2021-31586/): SQL injection in accellion:kiteworks (high 8.8)
- [CVE-2021-31585](https://insights.sbomify.com/CVE-2021-31585/): Privilege escalation in accellion:kiteworks (medium 6.7)
- [CVE-2021-31584](https://insights.sbomify.com/CVE-2021-31584/): Cross-site request forgery in sipwise:next generation communication platform (high 8.8)
- [CVE-2021-31583](https://insights.sbomify.com/CVE-2021-31583/): Cross-site scripting in sipwise:next generation communication platform (medium 5.4)
- [CVE-2021-31581](https://insights.sbomify.com/CVE-2021-31581/): Akkadian Provisioning Manager Engine (PME) Shell Escape via 'vi' editor interface (high 7.9)
- [CVE-2021-31580](https://insights.sbomify.com/CVE-2021-31580/): Akkadian Provisioning Manager Engine (PME) Shell Escape via 'exec' command (high 8.7)
- [CVE-2021-31579](https://insights.sbomify.com/CVE-2021-31579/): Akkadian Provisioning Manager Engine (PME) Hard-Coded Credentials (high 8.2)
- [CVE-2021-31578](https://insights.sbomify.com/CVE-2021-31578/): Memory corruption in EN7528, EN7580 (critical 9.8)
- [CVE-2021-31577](https://insights.sbomify.com/CVE-2021-31577/): Missing authorization in EN7528, EN7580 (critical 9.8)
- [CVE-2021-31576](https://insights.sbomify.com/CVE-2021-31576/): Missing authorization in EN7528, EN7580 (high 7.5)
- [CVE-2021-31575](https://insights.sbomify.com/CVE-2021-31575/): Command injection in EN7528, EN7580 (critical 9.8)
- [CVE-2021-31574](https://insights.sbomify.com/CVE-2021-31574/): Command injection in EN7528, EN7580 (critical 9.8)
- [CVE-2021-31573](https://insights.sbomify.com/CVE-2021-31573/): Command injection in EN7528, EN7580 (critical 9.8)
- [CVE-2021-31572](https://insights.sbomify.com/CVE-2021-31572/): Integer overflow in amazon:freertos (critical 9.8)
- [CVE-2021-31571](https://insights.sbomify.com/CVE-2021-31571/): Integer overflow in amazon:freertos (critical 9.8)
- [CVE-2021-31567](https://insights.sbomify.com/CVE-2021-31567/): WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability (medium 6.8)
- [CVE-2021-31566](https://insights.sbomify.com/CVE-2021-31566/): Path traversal in libarchive (high 7.8)
- [CVE-2021-31562](https://insights.sbomify.com/CVE-2021-31562/): Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm (medium 6.5)
- [CVE-2021-3156](https://insights.sbomify.com/CVE-2021-3156/): Sudo Heap-Based Buffer Overflow (high 7.8, exploited in the wild)
- [CVE-2021-31559](https://insights.sbomify.com/CVE-2021-31559/): S2S TcpToken authentication bypass (high 7.5)
- [CVE-2021-31558](https://insights.sbomify.com/CVE-2021-31558/): Delta Electronics DIAEnergie (Update A) (medium 6.5)
- [CVE-2021-31556](https://insights.sbomify.com/CVE-2021-31556/): Other in fedoraproject:fedora (critical 9.8)
- [CVE-2021-31555](https://insights.sbomify.com/CVE-2021-31555/): Other in mediawiki:mediawiki (high 7.5)
- [CVE-2021-31554](https://insights.sbomify.com/CVE-2021-31554/): Security feature bypass in mediawiki:mediawiki (medium 5.4)
- [CVE-2021-31553](https://insights.sbomify.com/CVE-2021-31553/): Denial of service in mediawiki:mediawiki (medium 6.5)
- [CVE-2021-31552](https://insights.sbomify.com/CVE-2021-31552/): Business logic in mediawiki:mediawiki (medium 5.4)
- [CVE-2021-31551](https://insights.sbomify.com/CVE-2021-31551/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2021-31550](https://insights.sbomify.com/CVE-2021-31550/): Cross-site scripting in mediawiki:mediawiki (medium 5.4)
- [CVE-2021-3155](https://insights.sbomify.com/CVE-2021-3155/): snapd created ~/snap with too-wide permissions (low 3.8)
- [CVE-2021-31549](https://insights.sbomify.com/CVE-2021-31549/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2021-31548](https://insights.sbomify.com/CVE-2021-31548/): Security feature bypass in mediawiki:mediawiki (medium 6.5)
- [CVE-2021-31547](https://insights.sbomify.com/CVE-2021-31547/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2021-31546](https://insights.sbomify.com/CVE-2021-31546/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2021-31545](https://insights.sbomify.com/CVE-2021-31545/): Information disclosure in mediawiki:mediawiki (medium 5.3)
- [CVE-2021-31542](https://insights.sbomify.com/CVE-2021-31542/): Path Traversal in Django (high 7.5)
- [CVE-2021-31540](https://insights.sbomify.com/CVE-2021-31540/): Misconfiguration in wowza:streaming engine (high 7.1)
- [CVE-2021-3154](https://insights.sbomify.com/CVE-2021-3154/): Code injection in solarwinds:serv-u (high 7.5)
- [CVE-2021-31539](https://insights.sbomify.com/CVE-2021-31539/): Information disclosure in wowza:streaming engine (medium 5.5)
- [CVE-2021-31538](https://insights.sbomify.com/CVE-2021-31538/): Path traversal in lancom-systems:lcos fx (high 7.5)
- [CVE-2021-31537](https://insights.sbomify.com/CVE-2021-31537/): Cross-site scripting in sisinformatik:sis-rewe go (medium 6.1)
- [CVE-2021-31535](https://insights.sbomify.com/CVE-2021-31535/): Memory corruption in fedoraproject:fedora (critical 9.8)
- [CVE-2021-31532](https://insights.sbomify.com/CVE-2021-31532/): Security feature bypass in nxp:i.mx rt500 firmware (medium 6.8)
- [CVE-2021-31531](https://insights.sbomify.com/CVE-2021-31531/): Server-side request forgery in zohocorp:manageengine servicedesk plus msp (critical 9.8)
- [CVE-2021-31530](https://insights.sbomify.com/CVE-2021-31530/): Information disclosure in zohocorp:manageengine servicedesk plus msp (high 7.5)
- [CVE-2021-3153](https://insights.sbomify.com/CVE-2021-3153/): Security feature bypass in hashicorp:terraform enterprise (medium 6.5)
- [CVE-2021-31525](https://insights.sbomify.com/CVE-2021-31525/): golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion (medium 5.9)
- [CVE-2021-31523](https://insights.sbomify.com/CVE-2021-31523/): Privilege escalation in xscreensaver project:xscreensaver (high 7.8)
- [CVE-2021-31522](https://insights.sbomify.com/CVE-2021-31522/): Apache Kylin unsafe class loading (critical 9.8)
- [CVE-2021-31521](https://insights.sbomify.com/CVE-2021-31521/): Cross-site scripting in Trend Micro InterScan Web Security Virtual Appliance (medium 5.4)
- [CVE-2021-31520](https://insights.sbomify.com/CVE-2021-31520/): Auth bypass in Trend Micro IM Security (high 8.1)
- [CVE-2021-3152](https://insights.sbomify.com/CVE-2021-3152/): Path traversal in home-assistant:home-assistant (medium 5.3)
- [CVE-2021-31519](https://insights.sbomify.com/CVE-2021-31519/): Privilege escalation in Trend Micro HouseCall for Home Networks (high 7.3)
- [CVE-2021-31518](https://insights.sbomify.com/CVE-2021-31518/): Denial of service in Trend Micro Home Network Security (high 7.5)
- [CVE-2021-31517](https://insights.sbomify.com/CVE-2021-31517/): Denial of service in Trend Micro Home Network Security (high 7.5)
- [CVE-2021-31516](https://insights.sbomify.com/CVE-2021-31516/): Use after free in Binary Ninja (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/162/